Hide Forgot
Description of problem: In RHEL6.4 version of IPA, I'm seeing internal errors when searching for delegations by group: [root@rhel6-1 ipa-delegation-cli]# ipa delegation-find --group=gr1000 ipa: ERROR: an internal error has occurred Version-Release number of selected component (if applicable): ipa-server-3.0.0-15.el6.x86_64 How reproducible: always Steps to Reproduce: 1. Setup IPA server 2. kinit admin 3. ipa group-add mg1000 --desc=mg1000 4. ipa group-add gr1000 --desc=gr1000 5. ipa delegation-add delegation_find_positive_1000 --membergroup=mg1000 --group=gr1000 --attrs=mobile 6. ipa delegation-find --group=gr1000 Actual results: ipa: ERROR: an internal error has occurred Expected results: returns delegation_find_positive_1000 listing Additional info: [root@rhel6-1 ipa-delegation-cli]# tail -19 /var/log/httpd/error_log [Tue Dec 18 14:07:06 2012] [error] ipa: INFO: admin@TESTRELM.COM: ping(): SUCCESS [Tue Dec 18 14:07:06 2012] [error] ipa: ERROR: non-public: AttributeError: 'unicode' object has no attribute 'value' [Tue Dec 18 14:07:06 2012] [error] Traceback (most recent call last): [Tue Dec 18 14:07:06 2012] [error] File "/usr/lib/python2.6/site-packages/ipaserver/rpcserver.py", line 334, in wsgi_execute [Tue Dec 18 14:07:06 2012] [error] result = self.Command[name](*args, **options) [Tue Dec 18 14:07:06 2012] [error] File "/usr/lib/python2.6/site-packages/ipalib/frontend.py", line 435, in __call__ [Tue Dec 18 14:07:06 2012] [error] ret = self.run(*args, **options) [Tue Dec 18 14:07:06 2012] [error] File "/usr/lib/python2.6/site-packages/ipalib/frontend.py", line 747, in run [Tue Dec 18 14:07:06 2012] [error] return self.execute(*args, **options) [Tue Dec 18 14:07:06 2012] [error] File "/usr/lib/python2.6/site-packages/ipalib/plugins/delegation.py", line 200, in execute [Tue Dec 18 14:07:06 2012] [error] results = api.Command['aci_find'](term, **kw)['result'] [Tue Dec 18 14:07:06 2012] [error] File "/usr/lib/python2.6/site-packages/ipalib/frontend.py", line 435, in __call__ [Tue Dec 18 14:07:06 2012] [error] ret = self.run(*args, **options) [Tue Dec 18 14:07:06 2012] [error] File "/usr/lib/python2.6/site-packages/ipalib/frontend.py", line 747, in run [Tue Dec 18 14:07:06 2012] [error] return self.execute(*args, **options) [Tue Dec 18 14:07:06 2012] [error] File "/usr/lib/python2.6/site-packages/ipalib/plugins/aci.py", line 804, in execute [Tue Dec 18 14:07:06 2012] [error] cn = groupdn[0]['cn'].value [Tue Dec 18 14:07:06 2012] [error] AttributeError: 'unicode' object has no attribute 'value' [Tue Dec 18 14:07:06 2012] [error] ipa: INFO: admin@TESTRELM.COM: delegation_find(None, group=u'gr1000', pkey_only=False, all=False, raw=False, version=u'2.46'): AttributeError
Something confusing me here though. When I run with --attrs=badattr it fails as expected instead of with internal error. [root@rhel6-1 ipa-delegation-cli]# ipa delegation-find --membergroup=mg1000 --group=gr1000 --attrs=badattrs --------------------- 0 delegations matched --------------------- ---------------------------- Number of entries returned 0 ---------------------------- [root@rhel6-1 ipa-delegation-cli]# tail -1 /var/log/httpd/error_log [Tue Dec 18 14:19:36 2012] [error] ipa: INFO: admin@TESTRELM.COM: delegation_find(None, attrs=(u'badattrs',), memberof=u'mg1000', group=u'gr1000', pkey_only=False, all=False, raw=False, version=u'2.46'): SUCCESS So, does that means it searches for the attrs first, finds nothing, so fails before it has a chance to hit the code searching for group?
Thanks for the report. I will start from your last comment. When we search with --attrs, we skip --group or any other following checks when this one fails because it is obvious that this particular delegation won't be included in the search result. About the bug report itself, this is indeed a bug. I will clone it upstream.
Upstream ticket: https://fedorahosted.org/freeipa/ticket/3311
Fixed upstream: master: https://fedorahosted.org/freeipa/changeset/86e56b91257efa8d7c8a388f2a8a14d0adf367e5 ipa-3-1: https://fedorahosted.org/freeipa/changeset/8183e2c94b7732f2e19cd257489609d0863c2124 ipa-3-0: https://fedorahosted.org/freeipa/changeset/00e18a808d76899b0619b634afa5a1c331113fa2
Verified. Version :: ipa-server-3.0.0-17.el6.x86_64 Manual Test Results :: [root@rhel6-1 ~]# kinit admin Password for admin@TESTRELM.COM: [root@rhel6-1 ~]# ipa group-add mg1000 --desc=mg1000 -------------------- Added group "mg1000" -------------------- Group name: mg1000 Description: mg1000 GID: 92400001 [root@rhel6-1 ~]# ipa group-add gr1000 --desc=gr1000 -------------------- Added group "gr1000" -------------------- Group name: gr1000 Description: gr1000 GID: 92400003 [root@rhel6-1 ~]# ipa delegation-add delegation_find_positive_1000 --membergroup=mg1000 --group=gr1000 --attrs=mobile ------------------------------------------------ Added delegation "delegation_find_positive_1000" ------------------------------------------------ Delegation name: delegation_find_positive_1000 Permissions: write Attributes: mobile Member user group: mg1000 User group: gr1000 [root@rhel6-1 ~]# ipa delegation-find --group=gr1000 -------------------- 1 delegation matched -------------------- Delegation name: delegation_find_positive_1000 Permissions: write Attributes: mobile Member user group: mg1000 User group: gr1000 ---------------------------- Number of entries returned 1 ----------------------------
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2013-0528.html